[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171r3

## Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171r3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.

Guidelines for Securing Wireless Local Area Networks (WLANs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Computer Security Division 2006 Annual Report:

neration of the Voluntary Voting System Guidelines (VVSG), focusing on developing a security architecture that addresses significant threats to voting systems and enhancing voting system auditability.
New and updated requirements developed for the next generation of the VVSG cover access control, secure software distribution and installation, setup validation,  system event logging,  cryptography,  voter  verified  paper  records,  physical  security,  and communications. To support the development of the next generation of the VVSG, two workshops on voting system threats were held, and we conducted research to enhance the auditability of voting systems.

Computer Security Division 2006 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce provide? (Part 5)

[Assistant]
urity (NICE Framework) , NIST Special Publication 800-181, Revision 1, and is expected to be read in that context. This document was released in draft form for comment twice prior to this publication.
The first draft was released in March 2021, along with an initial list of proposed Competency Areas. A second draft was released in December 2021. Feedback received on those drafts, conversations with NICE community members, and insights from workshops that brought together subject matter experts on this topic have matured understanding of NICE Framework Competency Areas. The adjustments to this document are the result. Any subsequent draft(s) may be further adjusted, including the separately provided Competency Areas, their descriptions, and associated Task, Knowledge, and Skill (TKS) statements. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

|                                                                                | Introduction ......................................................................................................................

NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations:

| Executive Summary ................................................................................................................... | Executive Summary ................................................................................................................... | Executive Summary ................................................................................................................... | vii   |
|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|-------|
| 1. Introduction ............................................................................................................................ | 1. Introduction ............................................................................................................................ | 1. Introduction ............................................................................................................................ | 1     |
| 1.1                                                                                | Purpose and Scope ....................................................................................................... | Purpose and Scope ....................................................................................................... | 1     |
| 1.2                                                                                | Audience .........................................................................................................................

Guide to Attribute Based Access Control (ABAC) Definition and Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of :

the identity and stated purposes of recipients of consumer reports. 15 U.S.C. § 1681, ei seq . Insurance Records Statutes -Require insurers to provide general information about their personal data practices to applicants and policyholders, with further information available upon request. Also require them to notify applicants about the collection and disclosure of personal data, and to specify when information is requested solely for marketing or research purposes. Restrict the use of "pretext interviews" (in which the identity or purpose of the interviewer is misrepresented) and require specific consent forms to be used for the collection of information that requires authorization from an individual. Permit individuals who are denied insurance to learn the specific reasons for such denial and to obtain access to the information used in refusing coverage. 19. Federal statutes prohibit the unauthorized use or disclosure of alcoholism and drug abuse treatment records byprivate clinics receiving Federal funds, except in a medical emergency, for research or audits, or under a court order. 21 U.S.C. § 1175; 42 U.S.C. § 290dd-3. 20. Virtually every State has statutes that limit the use and disclosure of medical or mental health records . See . e . q . Cal. Civ. Code § 56; Colo. Rev. Stat. § 18-4-412; Conn. Gen. Stat. § 52-146h; 111. Stat. ch . 91 1/2. § 801: Mass. Gen. Laws ch. Ill, § TOE; N.M. Stat. § 42-1-15. Pa. Stat. tit. 50, § 7111; R.I. Gen. Laws § 5-37.3.3; Tenn. Code § 10-7-504; Tex. Rev. Civ. Stat. art. 4447d; Wis. Stat. § 146.82. 21. The Family Educational Rights and Privacy Act provides that schools receiving public funds are prohibited from using or disclosing a student's records without the consent of the student (or the parent of a minor student) except for certain specified purposes, or pursuant to a court order or lawfully issued subpoena. 20 U.S.C. § 1232g. 22.

Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio provide? (Part 5)

[Assistant]
blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
## Audience

The primary audience for this publication is both Federal Government and non-Federal Government professionals at all levels who understand ICT risk management (ICTRM) for one or more ICT domains but may be unfamiliar with ERM. The secondary audience includes both Federal and non-Federal Government corporate officers, high-level executives, ERM officers and staff members, and others who understand ERM but may be unfamiliar with the unique characteristics of ICTRM. All readers are expected to gain an improved understanding of how ICTRM and ERM relate to each other, as well as the benefits of integrating their use. ## Document Conventions

For this document, 'assets' are defined as technologies that may compose an information or communications system. The term 'asset' or 'assets' is used in multiple frameworks and documents. Examples include laptop computers, desktop computers, servers, sensors, data, mobile phones, tablets, routers, and switches. In instances where the authors mean 'assets' as they might be discussed at the enterprise level, the word 'asset' will be preceded by words such as 'enterprise,' to differentiate context. This document uses the phrase 'information and communications technology' for ICT. As of this writing, both this phrase and the same phrase with 'communication' instead of 'communications' are widely used. The phrases essentially mean the same thing. This document references two types of controls, each of which is essential and should not be confused with the other:

- Internal controls are the overarching mechanisms used to achieve and monitor enterprise objectives.

Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to PIV Data Model Test Guidelines:

3.2.2 public key size

| Purpose            | Co irms that the size of the sed on th nf public key for digital signature used to sign e expiration of the PIV card and is in the biometrics is ba accordance with Table 3-3 of SP80078. 3.2.2  Verify asymmetric key pair

| Purpose      | Con that exists in the certificate corresponds to firms that the public key the p e card. 3.2.2: Verify signer public key size                         | The tester shall validate that the public key size is in accordance with Table 3-3 of SP 800-78.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Integrating Forensic Techniques into Incident Response:

LLC), Marc Rogers (Purdue University), and Miles Tracy (U.S. Federal Reserve System), as well as representatives from the Department of State, for their particularly valuable comments and suggestions.
Because of the variety of data sources, digital forensic techniques can be used for many purposes, such as investigating crimes and internal policy violations, reconstructing computer security incidents, troubleshooting operational problems, and recovering from accidental system damage. Practically every organization needs to have the capability to perform digital forensics (referred to as forensics throughout the rest of the guide). Without such a capability, an organization will have difficulty determining what events have occurred within its systems and networks, such as exposures of protected, sensitive data. This guide provides detailed information on establishing a forensic capability, including the development of policies and procedures. Its focus is primarily on using forensic techniques to assist with computer security incident response, but much of the material is also applicable to other situations.

Guide to Integrating Forensic Techniques into Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to U.S. Department of Justice Simplified Risk Analysis Guidelines:

- a. Accreditation - Accreditation is the official management authorization to operate an AIS or network in a particular security mode with a proscribed set of administrative, environmental, and technical security safeguards in a given operational environment. - b. Automated Information System (AIS) -An AIS is an assembly of computer hardware, software, and/or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information. An AIS will typically consist of ADP system hardware, operating system and application software, associated peripheral devices, and associated data communications equipment. An AIS includes PCs, work stations, and office automation systems. - c. Network -A network comprises communications media and all attached components whose responsibility is the transfer of information among a collection of AISs or work stations. Network components include packet switches, front-end computers, network controllers, and
4. technical control devices. - d. Sensitive Application Systems -Systems that process sensitive data or require protection due to the risk and magnitude of loss or harm that could result from improper operation or deliberate manipulation of the application. - b. This step also requires an accurate documentation of the security policies, procedures, and countermeasures currently in effect for the AIS. The security measures in place should include administrative procedures, software and hardware security controls, physical security access controls, personnel security controls, and a security awareness program as listed in Table 2 The current security control environment is important due to its impact on the evaluation of the need for additional security measures. - c. The person conducting the risk analysis should also obtain information on the impact of data disclosure, modification, destruction, and disruption of processing on the component's ability to meet mission objectives.

U.S. Department of Justice Simplified Risk Analysis Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendation for Stateful Hash-Based Signature Schemes:

The XMSS and XMSS MT parameter sets that are approved for use by this Special Publication are specified in Sections 5.1 through 5.4. The parameters n , w , len , h , and d specified in the tables are defined in Sections 3.1.1, 4.1.1, and 4.2.1 of [1].

The private n -byte strings in the WOTS + private keys (sk[i] in Section 3.1.3 of [1]) shall be generated using the pseudorandom key generation method specified in Algorithm 10' in Section 7.2.1: sk[ j ] = PRFkeygen( S\_XMSS , SEED || ADRS ), where PRFkeygen is as defined in Section 5 for the parameter set being used. 6 The private seed, S\_XMSS , shall be generated using an approved random bit generator [6], where the instantiation of the random bit generator supports at least 8 n bits of security strength. If more than one XMSS key pair is being created within a cryptographic module (including XMSS keys that belong to a single XMSS MT instance), then a separate random S\_XMSS shall be generated for each XMSS key pair.

Recommendation for Stateful Hash-Based Signature Schemes


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Representation of PIV Chain-of-Trust for Import and Export:

[FIPS201] describes three use cases for a chain-of-trust: 1) to extend enrollment, 2) to reissue a PIV Card, and 3) to transfer PIV Card enrollment records to another federal issuer or to a service provider. The purpose of this document is to provide the data representation of a chain-of-trust record for the transferal use case.  The data representation is based on a common XML (Extensible Markup Language) schema to facilitate interoperable information sharing and data exchange. The sending and receiving federal agencies will be able to exchange the chain-of-trust data according to the specifications provided in this document.  Similarly, a service provider will be able to receive chain-of-trust records from different client agencies that are based on a common XML schema specified in this document. This document also provides support for data integrity through digital signatures and for confidentiality through encryption of chain-oftrust data, in transit and at rest.

All PIV chain-of-trust records are signed using XML Signature. An XML Signature protects the integrity of the data and authenticates the issuer of the chain-of-trust. A valid

Representation of PIV Chain-of-Trust for Import and Export


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

NISTIR 8228 explores a number of challenges, grouped around conventional risk mitigation areas such as asset management, data protection, incident detection, and vulnerability management. The publication further groups these areas into goals of protecting device security, data security, and/or individual privacy. Challenges can arise that hinder risk mitigations in various areas or could impact some or all of the goals. For example, to mitigate risks related to vulnerability management, software updates may need to be performed. However, not all IoT devices allow for software updates (Challenges 8, 10, and 11). Even mitigations as simple as hiding passwords might not be achievable on IoT devices (Challenge 17). 3. Will the implementation or maturity of device cybersecurity capabilities and/or nontechnical supporting capabilities fail to satisfy key device cybersecurity requirements? Some IoT devices may completely lack key device cybersecurity requirements, potentially making the IoT device unusable by the organization. Other IoT devices may provide device cybersecurity requirements but not in the manner expected by the organization. For example, an IoT device may have a unique device identifier, but it may not be in a format the organization uses with other equipment. The organization will need to plan for how this identifier will be incorporated into its asset management processes. When an IoT device's cybersecurity capabilities lack maturity, the task of securing the device may be much more difficult. For example, an IoT device may encrypt data, but use a deprecated encryption module due to device resource constraints. In this case, the organization may need to apply significant compensating controls. 4. What are the physical, logical access, network, and other requirements of the IoT device and how do they relate to key device cybersecurity requirements?

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

List of Abbreviations and Acronyms .........................................................51                                    | Appendix A. List of Abbreviations and Acronyms .........................................................51                                    |                                                                                |
| Appendix B. Glossary........................................................................................................55                | Appendix B. Glossary........................................................................................................55                |                                                                                |
| Appendix C. Additional Resources ..................................................................................58                         | Appendix C. Additional Resources ..................................................................................58                         |                                                                                |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables                                                                                |
| Table 1. Baseline Profile for the Identify Function......................................................................10                   | Table 1.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to U.S. Department of Energy Risk Assessment Methodology:

|
| (*) 1. | PHYSICAL PROTECTION OF SPECIAL NUCLEAR MATERIAL AND VITAL EQUIPMENT | PHYSICAL PROTECTION OF SPECIAL NUCLEAR MATERIAL AND VITAL EQUIPMENT | DOE 5632.2A                         |
| m.
| SECURITY SURVEYS, NUCLEAR MATERIALS SURVEYS AND FACILITY APPROVALS  | SECURITY SURVEYS, NUCLEAR MATERIALS SURVEYS AND FACILITY APPROVALS  | DOE 5634.1 A                        |
| n. | CONTROL OF CLASSIFIED DOCUMENTS AND INFORMATION                     | CONTROL OF CLASSIFIED DOCUMENTS AND INFORMATION                     | DOE 5635.1 A                        |
| 0. | TECHNICAL SURVEILLANCE COUNTERMEASURES PROGRAM                      | TECHNICAL SURVEILLANCE COUNTERMEASURES PROGRAM                      | DOE 5636.3A                         |
| P-                                                | CLASSIFIED COMPUTER SECURITY PROGRAM                                | CLASSIFIED COMPUTER SECURITY PROGRAM                                | DOE 5637.1                          |
| q-                                                | PHYSICAL PROTECTION OF CLASSIFIED MATTER                            | PHYSICAL PROTECTION OF CLASSIFIED MATTER                            | DOE 5632.5                          |
| ( *) r. | PHYSICAL PROTECTION OF DOE PROPERTY AND UNCLASSIFIED FACILITIES     | PHYSICAL PROTECTION OF DOE PROPERTY AND UNCLASSIFIED FACILITIES     | DOE 5632.6                          |
| ( *) s. | PROTECTIVE FORCES                                                   | PROTECTIVE FORCES                                                   | DOE 5632.7                          |
| (*) t                                             | PROTECTION PROGRAM OPERATIONS: SYSTEM PERFORMANCE TESTS             | PROTECTION PROGRAM OPERATIONS: SYSTEM PERFORMANCE TESTS             | DOE 5632.8                          |
| ( *) u.

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Risk Assessment?

[Assistant]
According to Security Segmentation in a Small Manufacturing Environment:

To understand and configure the trusted communication between security zones, the communication requirements between assets must be determined based on a deep understanding of the existing traffic flows between all the assets in the plant or using a network monitoring tool. The traffic flows identified need to be validated for accuracy to detect any spurious traffic that may exist in the environment. A network monitoring tool typically gives a more accurate picture of the actual communication pattern between the assets that exists in the environment. Additionally, incorporating a network monitoring tool as part of the business and plant operation provides continuous visibility into assets, vulnerabilities in those assets, and network traffic. This helps mitigate the 'Poor Visibility of assets and network traffic' vulnerability that typically exists in the small manufacturing environment. - RA - Remote Access. - AAC- Authentication and Access Control
- BkUp - Back up
- FW-Firewall
- VM- Vulnerability Management
- BAD-Behavior Anomaly Detection
- EDR- Endpoint Detection and Response

| CSF subcategory   | Security Control Description                                            | Solu- tions   | Security Zone             | Security Zone             | Security Zone              | Security Zone                  | Security Zone   |
|-------------------|-------------------------------------------------------------------------|---------------|---------------------------|---------------------------|----------------------------|--------------------------------|-----------------|
|                   |                                                                         |               | Connectivity Services (M) | Business Applications (M) | Administrative Systems (H) | Manufacturing Applications (H) | ICS (ICS)       |
| DE.CM-1           | Monitor the network to detect potential cybersecurity events.

Security Segmentation in a Small Manufacturing Environment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Identification and Authentication?

[Assistant]
According to Fiscal Year 2024 Cybersecurity and Privacy Annual Report:

- PRIORITY AREAS -
- Cryptography 5
- Education & Workforce 7
- Emerging Technology 9
- HumanCentered Cybersecurity 11
- Identity & Access Management 13
- Privacy 15
- Risk Management 17
- Trusted Networks & Platforms 19
- National Cybersecurity Center of Excellence (NCCoE) 21
- Stakeholder Engagement & Events 24

## Identity & Access Management

## IDENTITY & ACCESS MANAGEMENT

Fiscal Year 2024 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Stateless Hash-Based Digital Signature Standard:

1. Name of Standard. Stateless Hash-Based Digital Signature Standard (FIPS 205). 2. Category of Standard. Computer Security. Subcategory. Cryptography. 3. Explanation. This standard specifies a stateless hash-based digital signature scheme (SLHDSA) for applications that require a digital signature rather than a written signature. Additional digital signature schemes are specified and approved in other NIST Special Publications and FIPS publications (e.g., FIPS 186-5 [1]). A digital signature is represented in a computer as a string of bits and computed using a set of rules and parameters that allow the identity of the signatory and the integrity of the data to be verified. Digital signatures may be generated on both stored and transmitted data. 7. Applications. A digital signature algorithm allows an entity to authenticate the integrity of signed data and the identity of the signatory. The recipient of a signed message can use a digital signature as evidence in demonstrating to a third party that the signature was, in fact, generated by the claimed signatory. This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time. A digital signature algorithm is intended for use in electronic mail, electronic funds transfer, electronic data interchange, software distribution, data storage, and other applications that require data integrity assurance and data origin authentication. 8. Implementations. A digital signature algorithm may be implemented in software, firmware, hardware, or any combination thereof. NIST will develop a validation program to test implementations for conformance to the algorithms in this standard. For every computational procedure that is specified in this standard, a conforming implementation may replace the given set of steps with any mathematically equivalent process. In other words, different procedures that produce the correct output for every input are permitted.

Stateless Hash-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

adversaries using cyberspace to their advantage and from our own efforts to employ the global nature of cyberspace to achieve objectives in military, intelligence, and business operations... '
- ' ...
For operational plans development, the combination of threats, vulnerabilities, and impacts must be evaluated in order to identify important trends and decide where effort should be applied to eliminate or reduce threat capabilities; eliminate or reduce vulnerabilities; and assess, coordinate, and deconflict all cyberspace operations... '
- ' ... Leaders at all levels are accountable for ensuring readiness and security to the same degree as in any other domain... '
- -- THE NATIONAL STRATEGY FOR CYBERSPACE OPERATIONS OFFICE OF THE CHAIRMAN, JOINT CHIEFS OF STAFF, U.S. DEPARTMENT OF DEFENSE

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products provide?

[Assistant]
## Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products

National Institute of Standards and Technology

February 4, 2022

This publication is available free of charge from: https://doi.org/10.6028/NIST.CSWP.02042022-2

<!-- image -->

## Abstract

Executive Order (EO) 14028, 'Improving the Nation's Cybersecurity,' tasks the National Institute of Standards and Technology (NIST), in coordination with the Federal Trade Commission (FTC) and other agencies, to initiate pilot programs for cybersecurity labeling. NIST is, among other actions, directed '… to identify IoT cybersecurity criteria for a consumer labeling program…' This document seeks to fulfill this directive by recommending consumer IoT product label criteria, label design and consumer education considerations, and conformity assessment considerations for use by a scheme owner to inform a consumer Internet of Things (IoT) product labeling program. ## Keywords

Consumer IoT; criteria; cybersecurity; executive order; label. ## Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only;  it  does  not  imply  recommendation  or  endorsement  by  NIST,  nor  does  it  imply  that  the products mentioned are necessarily the best available for the purpose. ## Additional Information

For additional information on NIST's Cybersecurity programs, projects and publications, visit the Computer Security Resource Center. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is also available. Submit comments on this publication to:

labeling-eo@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA).

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to a Secure Enterprise Network Landscape provide? (Part 2)

[Assistant]
may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2022-11-10

## How to Cite this NIST Technical Series Publication:

Chandramouli R (2022) Guide to a Secure Enterprise Network Landscape.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Service Mesh Proxy Models for Cloud-Native Applications:

........5                                   | 2. Typical Service Mesh Data Plane Capabilities and Associated Proxy Functions .................................5                                   |
| 3.
Proxy Models (Data Plane Architectures) in Service Mesh Implementations ....................................7                                    | 3. Proxy Models (Data Plane Architectures) in Service Mesh Implementations ....................................7                                    |
| 4. Data Plane Architecture Threat Scenarios and Analysis Methodology............................................12                                  | 4. Data Plane Architecture Threat Scenarios and Analysis Methodology............................................12                                  |
| 5. Detailed Threat Analysis for Data Plane Architectures...................................................................14                       | 5. Detailed Threat Analysis for Data Plane Architectures...................................................................14                       |
| 5.1.1. | Compromised L4 Proxy (TR-1).................................................................................................14                      |
| 5.1.2. | Compromised Application Container (TR-2)...........................................................................14                               |
| 5.1.3. | Compromise of Business Data (TR-3)......................................................................................15                          |
| 5.1.4. | Compromised L7 Proxy (TR-4).................................................................................................15                      |
| 5.1.5. | Compromise of Shared L7 Proxy (TR-5) ..................................................................................15                           |
| 5.1.6.

Service Mesh Proxy Models for Cloud-Native Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security Architecture Design Process for Health Information Exchanges (HIEs):

| 5                                                                        |
| Figure 2. HIE Security Architecture Design Process ......................................................................
| 7                                                                        |
| Figure 3. Enabling Services........................................................................................................... | 13                                                                       |
| Figure 4. Notional Architecture Development Process................................................................. | 22                                                                       |
| Figure 5. Basic Identity and Access Management Components ................................................... | 24                                                                       |
| Figure 6. Web Services Security Standards................................................................................... | 26                                                                       |
| Figure 7. Illustrative Steps from Notional Architecture to Secure HIE Services.......................... | 27                                                                       |
| Figure 8. Regional HIEs with Standard Enabling Services........................................................... | 28                                                                       |
| Figure 9. Multi-Regional HIE with Federated Enabling Services................................................. | 29                                                                       |
| Figure 10. Nationwide HIE with Federated Data Protection Services .......................................... | 29                                                                       |
| Figure 11. Clinical Assessment Scenario of 2008 ONC Personalized Healthcare Use Case......

Security Architecture Design Process for Health Information Exchanges (HIEs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-204D

## Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

Ramaswamy Chandramouli Frederick Kautz Santiago Torres-Arias

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-204D

<!-- image -->

## NIST Special Publication 800 NIST SP 800-204D

## Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

Frederick Kautz TestifySec

Santiago Torres-Arias Electrical and Computer Engineering Department Purdue University

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-204D

February 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2009 Annual Report provide? (Part 3)

[Assistant] ISO Standardization of Cryptographic ModuleTesting | 18 18 | Security Content Automation Protocol | 39 | 39 | | | | National Checklist Program | 41 | 41 | | Guidelines and Documents | | Security Content Automation Protocol Validation | 43 | 43 | | | | Program | | | | CryptographicTechnology Group | | Technical Security Metrics | 44 | 44 | | | 21 | | 44 | 44 | | Cryptographic Standards Toolkit | 21 21 | Vulnerability Measurement and Scoring Network Security Analysis Using Attach | | | | Hash Algorithms Security Guidelines of Using Approved Hash Algorithms | 21 | Graphs | 44 | 44 | | Digital Signatures Random Number Generation | 22 22 | Infrastructure Services, Protocols, and Applications Internet Protocol Version 6 and Internet Protocol | 45 45 | Security | | | 22 | Securing the Domain Name System Wireless Security Standards | 46 | 46 | | | | | 47 | 47 | | Key Establishment Using | 22 | | | | | Public Key Cryptography Block Cipher Modes of Operation | | CSD's Part in National and International IT Security | | | | Key

Computer Security Division 2009 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide for Conducting Risk Assessments:

## Guide for Conducting Risk Assessments

| CHAPTER ONE INTRODUCTION ..........................................................................................1   | CHAPTER ONE INTRODUCTION ..........................................................................................1              | CHAPTER ONE INTRODUCTION ..........................................................................................1              |                                                                                |
|------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSE AND APPLICABILITY .................................................................................................. | PURPOSE AND APPLICABILITY .................................................................................................. | 2                                                                                |
| 1.2                                                                                | TARGET AUDIENCE.................................................................................................................. | TARGET AUDIENCE..................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to Fiscal Year 2021 Cybersecurity and Privacy Annual Report:

organization identity cards. The foundation of any data center or edge computing security strategy should be securing the platform  on  which  data  and  workloads  will  be  executed  and  accessed.
The  physical  platform represents the first layer for any layered security approach and provides the initial protections to help ensure that higher-layer security controls can be trusted. In FY 2021, the NCCoE continued to  develop and demonstrate approaches based on hardware-enabled security techniques and technologies  for  safeguarding  data  and  workloads. Hardware-Enabled  Security:  Container Platform Security Prototype (NISTIR 8320A) was finalized in June 2021, and a second public comment draft of Hardware-Enabled Security: Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases (NISTIR 8320) was released in May 2021. Additional publications in the NISTIR 8320 series are also under development.

Fiscal Year 2021 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Security Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

Controlled Unclassified Information; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; nonfederal organizations; nonfederal systems; organization-defined parameter; security assessment; security control; security requirement.

- Federal agencies responsible for managing and protecting CUI
- Nonfederal organizations responsible for protecting CUI
- Individuals with system development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)
- Individuals with acquisition or procurement responsibilities (e.g., contracting officers)
- Individuals with system, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)
- Individuals with security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, analysts, independent verifiers and validators)

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

- GLYPH<c=31,font=/HHCKCL+Webdings> Audiovisual Device Monitoring . A few host-based IDPS products can detect when a host's audiovisual devices, such as microphones, cameras, or IP-based phones are activated or used. This could indicate that the host has been compromised by an attacker. - GLYPH<c=31,font=/HHCKCL+Webdings> Host Hardening . Some host-based IDPSs can automatically harden hosts on an ongoing basis. For example, if an application is reconfigured, causing a particular security function to be disabled, the IDPS could detect this and enable the security function. - GLYPH<c=31,font=/HHCKCL+Webdings> Process Status Monitoring . Some products monitor the status of processes or services running on a host, and if they detect that one has stopped, they restart it automatically. Some products can also monitor the status of security programs such as antivirus software. - GLYPH<c=31,font=/HHCKCL+Webdings> Network Traffic Sanitization . Some agents, particularly those deployed on appliances, can sanitize the network traffic that they monitor. For example, an appliance-based agent could act as a proxy and rebuild each request and response that is directed through it. This can be effective at neutralizing certain unusual activity, particularly in packet headers and application protocol headers. Sanitization performed by an appliance can also reduce the amount of reconnaissance the attackers can perform on the host it is protecting. Examples include hiding the servers' OS fingerprints and application error messages. Some products can also prevent sensitive information such as social security numbers and credit card numbers from being displayed on Web server pages.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to PBX Administrator’s Security Standards:

NIST expresses its appreciation to FDIC for their kind permission to publish this report. We also wish to acknowledge the many security professionals who participated in the development of these standards, and in particular: Mr. Brian Seborg, Task Manager; Mr. Earl Bears, Chief, Voice Network Services Unit; Mr. Garrett Mussmann, Chief, Automation Security Unit; Mr. Gary Sarsfield, Chief, Branch Support Section; and Mr. John Laclede, I-NET Program Manager. | Policy                                  |          |
|-----------------------------------------|----------|
| Section 1: FDIC Telephone               |          |
| FDIC Telephone Usage Policy             | 1-1      |
| PBX Protection Policy                   | 1-1      |
| Acquisition Policy                      | 1-1      |
| Security Incident Reporting Policy      | 1-1      |
| Typical Telephone System Configurations | 1-2      |
| Terms Used in GS/SYS85 and G1/SYS75     | 1-3      |
| Section 2: PBX Fraud                    |          |
| PBX Fraud History                       | 2-1      |
| Illegally Obtaining Authorization Codes | 2-2      |
| Observation                             | 2-2      |
| Social Engineering Schemes              | 2-2      |
| Operator Direct Dial Scheme             | 2-2      |
| Call/Sell Operations                    | 2-3      |
| Call Diverter Schemes                   | 2-3      |
| Remote Access Fraud                     | 2-3      |
| Voice Mail Fraud                        | .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Attribute Considerations for Access Control Systems:

............................................................................. | Introduction............................................................................................................
| 1    |
|    | 1.1 Purpose.....................................................................................................................................1  | 1.1 Purpose.....................................................................................................................................1  |      |
|    | 1.2 Scope........................................................................................................................................2 | 1.2 Scope........................................................................................................................................2 |      |
|    | 1.3 Audience ...................................................................................................................................2  | 1.3 Audience ...................................................................................................................................2  |      |
|    | 1.4 Document Structure ..................................................................................................................2         | 1.4 Document Structure ..................................................................................................................2         |      |
| 2  | Consideration Elements........................................................................................ | Consideration Elements........................................................................................ | 4    |
| 3  | Attribute Considerations....................................................................................... | Attribute Considerations.......................................................................................

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Report of the Workshop on Cryptography in Support of Computer Security provide? (Part 3)

[Assistant]
working group discussed potential weaknesses of the DES, such as the limitations in key length, the non-random structure of the S-boxes, and possible vulnerabilities to less than exhaustion atacks. 2.
Some participants felt that the 56-bit key was too short against hightechnology, high cost attack. One assertion was made that the algorithm could be sucessfully attacked for a cost of $20 million. It was pointed out that the first workshop on technology included estimates that the actual cost of building a key-extraction machine would be at least $72 million, the completion date would be 1990, the exhaustion time would be approximately 20 hours, and the probability of success would be low. One participant stated that his personal estimate of the cost (actual cost of production to a manufacturer) to build such a machine would be on the order of $200 million, could not be delivered until at least 1981, would produce 1 key per day, would have a low probability of success and that such a machine would never

be built. Claims were made that the cost would decrease by an order of magnitude every five years. The general response was that in spite of this the key was satisfactory for all security requirements of economic data (money transfers, proprietary data) and that using the algorithm serially (cascading two chips) satisfied all security requirements for data protected by the proposed DES. 3. There was a concern that S-boxes were non-random and the designer stated this to be true. When reasons for the choice of non-random S-boxes were requested, the designer stated:
- a. Non-random entries were necessary to provide security. - b. The design criteria, independently derived, coincided with some that were classified and the designers agreed not to make them public. - c. Of the possible good S-boxes, these were chosen to minimize combinatorial logic. - d. The draft DES, published by NBS, was exactly as designed and submitted. 4.

Report of the Workshop on Cryptography in Support of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Security Assurance Requirements for Linux Application Container Deployments:

The containers running in the container stack can either be system containers or application containers. A container that behaves like a full OS and runs programs such as sshd (secure session establishment) and syslogd (logging capability) is called a system container, while one that runs only an application is called an application container [2]. This document focuses on

Building a TPM architecture is not the only type of approach for providing trust rooted in hardware for the container stack. Another type of approach that has been proposed is to leverage the trusted execution support of some CPU architectures to protect processes running in a container against attacks from sources inside the same container stack. This includes privileged software in the same stack such as the container runtime and host OS kernel [8]. A mechanism or security solution based on this type of approach is discussed and analyzed in section 3.3.

Installing a container-specific OS (as opposed to a generic OS distribution), keeping OS versions up-to-date and patched, utilizing logging features that can track anomalous accesses to the OS, and any escalation to perform privileged operations form the crux of Host OS countermeasures in the Container Security Guide . In addition to the above countermeasures, it is also a good OS security practice to disable all unused interfaces (Serial or Proprietary) on the host and minimize the user and administrative accounts and groups. In addition to these, there are Linux-specific patches, such as grsecurity [9] and PaX [10], that are available for Linux distributions. All measures combined should provide the following security assurance for the host OS:

Security Assurance Requirements for Linux Application Container Deployments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.1.2. 3.1.2. 3.1.2.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

3.3.2                                               |
| PROTECT    | Identity Management, Authentication and Access Control (PR. 3.3.2.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guidelines on Firewalls and Firewall Policy:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    |
|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic provide? (Part 2)

[Assistant]
imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose.
## Contents

| Company Overview.................................................................................................................2         |
|--------------------------------------------------------------------------------------------------------------------------------------------|
| Risk Profile ..........................................................................................................................2   |
| Highlighted Practices in Cyber Supply Chain Management ..................................................2                                 |
| Organizational Approach to Supply Chain Risk and Cybersecurity............................................3                                |
| Supplier Management.............................................................................................................3          |
| Key Aspects of Managing Supplier Relationships .................................................................3                          |
| Measuring Supplier Risk ......................................................................................................4            |
| Quality Management and Continuous Improvement...........................................................4                                  |
| Incident Response and Recovery .........................................................................................4                  |
| Lessons Learned and Improvement Opportunities ..................................................................5                          |
| References ..............................................................................................................................5 |

<!-- image -->

## Company Overview

The Mayo Clinic is an academic, medical non-profit based in Rochester, Minnesota that serves over 1.2 million patients across Arizona, Florida and Minnesota each year.

Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Assurance Requirements for Linux Application Container Deployments provide? (Part 4)

[Assistant]
ines and countermeasures have been proposed by NIST through the Application Container Security Guide (NIST Special Publication 800-190) (referred to in this document as the Container Security Guide ).
The Container Security Guide identified security threats to the components of the platform hosting the containers and related artifacts involved in building containers and storing them prior to launch. Taking into consideration the overall security implications for the entire ecosystem involving containers, the document also provided security countermeasures for and through six entities including Hardware, Host Operating System (OS), Container Runtime, Image, Registry and Orchestrator. To carry out these recommendations in the form of countermeasures, one or more security solutions are needed. For these security solutions to effectively meet their security objectives, it is necessary to analyze those security solutions and detail the metrics they must satisfy in the form of security assurance requirements. This is the objective and contribution of this document. Linux and its various distributions form the predominant host OS component of the deployed container platforms. Since they are open-source products, sufficient security related information is available to analyze the security solutions that can be configured using features provided by Linux. Hence the focus of this document is on security assurance requirements for security solutions for application containers hosted on Linux. The target audience includes system security architects and administrators who are responsible for the actual design and deployment of security solutions in enterprise infrastructures hosting containerized hosts. ## Table of Contents

| Executive Summary..................................................................................................... | Executive Summary.....................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does CMVP Approved Non-Invasive Attack Mitigation Test Metrics_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 5)

[Assistant]
quirement; vendor evidence; vendor documentation. ## Audience

This document is focused toward the vendors, testing labs, and CMVP for the purpose of addressing issues in cryptographic module testing.
## Table of Contents

|   1 | Scope...................................................................................................................1           |
|-----|-------------------------------------------------------------------------------------------------------------------------------------|
| 2   | Normative references.........................................................................................1                      |
| 3   | Terms and definitions ........................................................................................1                     |
| 4   | Symbols and abbreviated terms .......................................................................1                              |
| 5   | Document organization......................................................................................2                        |
| 5.1 | General...........................................................................................................................2 |
| 5.2 | Modifications...................................................................................................................2   |
| 6   | CMVP-approved non-invasive attack mitigation test metric requirements...2                                                           |
| 6.1 | Purpose ..........................................................................................................................2 |
| 6.2 | Approved non-invasive attack mitigation test metrics.....................................................2                          |

## 1 Scope

This document specifies the Cryptographic Module Validation Program (CMVP) modifications of the methods to be used by a Cryptographic and Security Testing Laboratory (CSTL) to demonstrate conformance.

CMVP Approved Non-Invasive Attack Mitigation Test Metrics_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products provide? (Part 2)

[Assistant]
ybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA).
## Table of Contents

| Introduction ............................................................................................................1      | Introduction ............................................................................................................1      | Introduction ............................................................................................................1   |
|---------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | 1.1                                                                                | Background..................................................................................................... 1            |
|                                                                                | 1.2 Scheme and Scheme Owner.......................................................................... | 1                                                                                |
|                                                                                | 1.3 Document Scope and Goals...........................................................................

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

| SU - SOFTWARE                                                                                | UPDATE.................................................................................. 27   |
|--------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|
| (UPD) Update Capabilities ............................................................................27     |                                                                                |
| (APP) Update Application Support................................................................28           |                                                                                |
| CS - CYBERSECURITY STATE AWARENESS...................................................

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

Supplemental Guidance: The evaluation of alternative courses of action can include: (i) the expected effectiveness in achieving desired risk response (and how effectiveness is measured and monitored); and (ii) anticipated feasibility of implementation, including, for example, mission/business impact, political, legal, social, financial, technical, and economic considerations. Economic considerations include costs throughout the expected period of time during which the course of action is followed (e.g., cost of procurement, integration into organizational processes at Tier 1 and/or Tier 2, information systems at Tier 3, training, and maintenance). During the evaluation of alternative courses of action, trade-offs can be made explicit between near-term gains in mission/business effectiveness or efficiency and long-term risk of mission/business harm due to compromise of information or information systems that are providing this nearterm benefit. For example, organizations concerned about the potential for mobile devices (e.g., laptop computers) being compromised while employees are on travel can evaluate several courses of action including: (i) providing users traveling to high-risk areas with clean laptops; (ii) removing hard drives from laptops and operate from CDs or DVDs; or (iii) having laptops go through a detailed assessment before being allowed to connect to organizational networks. The first option is highly effective as returning laptops are never connected to organizational networks. While the second option ensures that hard drives cannot be corrupted, it is not quite as effective in that it is still possible that hardware devices (e.g., motherboards) could have been compromised. The effectiveness of the third option is limited by the ability of organizations to detect potential insertion of malware into the hardware, firmware, or software. As such, it is the least effective of the three options.

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to 2020 Cybersecurity and Privacy Annual Report:

- NISTIR  8272, Impact  Analysis  Tool  for  Interdependent  Cyber  Supply  Chain  Risks , describes a prototype solution for filling the gap between an organization's risk appetite and supply chain risk posture by providing a basic measurement of the potential impact of a cyber supply chain event. This tool does not represent a complete C-SCRM solution but is intended to be integrated into or used in concert with tools such as third-party management, enterprise resource planning, and supply chain management. - The Federal Acquisition Security Council, which was created as a requirement of the U.S. Federal Acquisition Supply Chain Security Act of 2018, helps develop policies and processes for  agencies  to  use  when  purchasing  technology  products. It  recommends C-SCRM standards, guidelines, and practices that NIST should develop. - The  Initial  Public  Draft  of  NISTIR  8276, Key  Practices  in  Cyber  Supply  Chain  Risk Management: Observations from Industry , provides a high-level summary of practices deemed by subject matter experts to be foundational to an effective C-SCRM program. It is based on an analysis of interviews with companies over several years (leading to the development of 24 case studies), prior NIST research in C-SCRM, and several standards and industry best practices documents. This work builds on the Roadmap for Improving Critical Infrastructure Cybersecurity, a companion document to the NIST Cybersecurity Framework. The NISTIR is based on an analysis of interviews with companies over several years (leading to the development of 24 case studies), prior NIST research in cyber supply chain risk management, and several standards and industry best practices documents.

2020 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms provide?

[Assistant]
## NISTIR 8320B

## Hardware-Enabled Security:

Policy-Based Governance in Trusted Container Platforms

Michael Bartock Murugiah Souppaya Haidong Xia Raghu Yeluri Uttam Shetty Brandon Lum Mariusz Sabath Harmeet Singh Alaa Youssef Gosia Steinder Yu Cao Jayashree Ramanathan

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8320B

<!-- image -->

## NISTIR 8320B

## Hardware-Enabled Security:

Policy-Based Governance in Trusted Container Platforms

Michael Bartock Murugiah Souppaya Computer Security Division Information Technology Laboratory

Haidong Xia Raghu Yeluri Uttam Shetty Intel Corporation Santa Clara, California

Brandon Lum Mariusz Sabath Harmeet Singh Alaa Youssef Gosia Steinder IBM Armonk, New York

Yu Cao Jayashree Ramanathan Red Hat Raleigh, North Carolina

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8320B

April 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8320B 41 pages (April 2022)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8320B

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to PIV Data Model Test Guidelines:

. No requirement for vendor all validate that the signature algorithm is based on the expiration TE06.03.15.01: The tester sh date of the PIV card and is in accordance with Table 3-4 of SP80078. | DTR from Section 5   | Test Assertion from Section 9                                                                           | DTR Description                                                                                |
|----------------------|---------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
| TE05.03.10.01        | 9.1.2.7 Biometric Type Values 9.2.2.7 Biometric Type Values                                             | eld plates The tester shall verify that the Biometric Type fi contains 0x000008 for fingerprint images or tem and 0x000002 for facial images. |
| TE05.03.11.01        | ric Data Type 9.1.2.8 Biomet 9.1.2.8 Biometric Data Type                                                | tester shall verify that the Biometric Data Type templates and b001xxxxx for facial image. The value is b100xxxxx for processed fingerprint   |
| TE05.03.12.01        | 9.1.2.9 Biometric D Quality ata                                                                         | The tester shall verify that the value of Biometric Data Quality is between -2 and 100. |
| TE05.03.12.02        | 9.2.2.9 Biometric D Quality ata                                                                         | The tester shall verify that the value of Biometric Data Quality is -2 for a facial image. |
| TE05.03.13.01        | 9.1.2.10 Creator Fie 9.2.2.10 Creator ld Value Field Value                                              | The tester shall verify the Creator field value.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Measuring the Usability and Security of Permuted Passwords on Mobile Platforms:

It's important to note that password entropy is only useful in password guessing attacks. Entropy is not an effective metric for determining resistance against keylogging and phishing attacks. Higher entropy passwords may be slightly more secure against shoulder surfing attacks as longer and more complex passwords are often more difficult to capture by the human eye from a distance. However, as technology advances, even these longer passwords may not be secure against automated shoulder surfing tools and new computer vision algorithms [12].

Measuring the Usability and Security of Permuted Passwords on Mobile Platforms